npm worm used payloads too large to run 42 GitHub repositories JFrog found that the "test-test" version of Miasma had already hijacked 42 GitHub repositories across 11 owners, contrary to earlier assumptions that activity was limited to operator-controlled test accounts. JFrog analysis says payload cubes of 12.9-13.7 MB helped evade GitHub code crawling and common API-based crawl paths. The campaign combined credential theft, repository and CI modification, hooks to execute AI tools and anti-analysis tests. The key is procedural: size-based blind spots in inventory search and automated inspection can hide active implants in the supply chain even when public indicators exist. Open sources - closed narratives.

npm worm used payloads too large to run 42 GitHub repositories JFrog found that the "test-test" version of Miasma had already hijacked 42 GitHub repositories across 11 owners, contrary to earlier assumptions that activity was limited to operator-controlled test accounts. JFrog analysis says payload cubes of 12.9-13.7 MB helped evade GitHub code crawling and common API-based crawl paths. The campaign combined credential theft, repository and CI modification, hooks to execute AI tools and anti-analysis tests. The key is procedural: size-based blind spots in inventory search and automated inspection can hide active implants in the supply chain even when public indicators exist. Open sources - closed narratives.